# CWE-345.

Every Advisory and CVE whose sources give the weakness CWE-345, newest first.

## Records, newest first (an older page)

- [PyJWT accepts unknown \`crit\` header extensions](https://agentprime.io/advisories/GHSA-752w-5fwx-jx9f.md)
  `GHSA-752w-5fwx-jx9f`, `CVE-2026-32597`, `PYSEC-2026-120` · PyPI `pyjwt`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2026 · Tags: Weak cryptography or TLS, Broken access control, CWE-345
- [ZeptoClaw: Email Sender Spoofing to bypass Header-Only From Allowlist Validation](https://agentprime.io/advisories/GHSA-4cm8-xpfv-jv6f.md)
  `GHSA-4cm8-xpfv-jv6f` · crates.io `zeptoclaw`: affected `<0.7.6`, fixed in `0.7.6` · CVSS 6.5 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Authentication bypass, CWE-345
- [ZeptoClaw: Generic webhook channel trusts caller-supplied identity fields; allowlist is checked against untrusted payload data](https://agentprime.io/advisories/GHSA-46q5-g3j9-wx5c.md)
  `GHSA-46q5-g3j9-wx5c`, `CVE-2026-32231` · crates.io `zeptoclaw`: affected `<0.7.6`, fixed in `0.7.6` · CVSS 8.2 High · Not analysed yet · Published 12 Mar 2026 · Tags: Authentication bypass, CWE-345
- [An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile](https://agentprime.io/advisories/CVE-2025-67298.md)
  `CVE-2025-67298` · CVE record · CVSS 8.1 High · Not analysed yet · Published 11 Mar 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [Windows App Installer Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-23656.md)
  `CVE-2026-23656` · CVE record: Microsoft Windows App Client for Windows Desktop · CVSS 5.9 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-345
- [OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding](https://agentprime.io/advisories/GHSA-656w-6f6c-m9r6.md)
  `GHSA-656w-6f6c-m9r6`, `CVE-2026-30920` · npm `@oneuptime/common`: affected `<10.0.19`, fixed in `10.0.19` · CVSS 8.6 High · Not analysed yet · Published 9 Mar 2026 · Tags: Broken access control, CWE-345
- [mkj Dropbear S Range Check curve25519.c unpackneg signature verification](https://agentprime.io/advisories/CVE-2026-3706.md)
  `CVE-2026-3706` · CVE record: mkj Dropbear · CVSS 6.3 Medium · Not analysed yet · Published 8 Mar 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation](https://agentprime.io/advisories/GHSA-7r4p-vjf4-gxv4.md)
  `GHSA-7r4p-vjf4-gxv4`, `CVE-2026-30851`, `GO-2026-4639` · Go `github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy`: affected `>=2.10.0, <2.11.2`, fixed in `2.11.2` · CVSS 8.1 High · Not analysed yet · Published 6 Mar 2026 · Tags: Authentication bypass, CWE-345
- [Pingora vulnerable to cache poisoning via insecure-by-default cache key](https://agentprime.io/advisories/GHSA-f93w-pcj3-rggc.md)
  `GHSA-f93w-pcj3-rggc`, `CVE-2026-2836`, `RUSTSEC-2026-0035` · crates.io `pingora-cache`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 8.4 High · Not analysed yet · Published 5 Mar 2026 · Tags: Broken access control, CWE-345
- [OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes](https://agentprime.io/advisories/GHSA-g962-2j28-3cg9.md)
  `GHSA-g962-2j28-3cg9`, `CVE-2026-30223`, `GO-2026-4622` · Go `github.com/OliveTin/OliveTin`: affected `<0.0.0-20260304231339-e97d8ecbd8d6`, fixed in `0.0.0-20260304231339-e97d8ecbd8d6` · CVSS 8.8 High · Not analysed yet · Published 5 Mar 2026 · Tags: Authentication bypass, CWE-345
- [Gogs: Cross-repository LFS object overwrite via missing content hash verification](https://agentprime.io/advisories/GHSA-cj4v-437j-jq4c.md)
  `GHSA-cj4v-437j-jq4c`, `CVE-2026-25921`, `GO-2026-4616` · Go `gogs.io/gogs`: affected `<0.14.2`, fixed in `0.14.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-345
- [RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload](https://agentprime.io/advisories/CVE-2026-30798.md)
  `CVE-2026-30798` · CVE record: rustdesk-client RustDesk Client · CVSS 8.2 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-345, CWE-755
- [RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings](https://agentprime.io/advisories/CVE-2026-30792.md)
  `CVE-2026-30792` · CVE record: rustdesk-client RustDesk Client · CVSS 8.3 High · Not analysed yet · Published 5 Mar 2026 · Tags: CWE-345
- [OpenClaw's voice-call Twilio replay dedupe now bound to authenticated webhook identity](https://agentprime.io/advisories/GHSA-gcj7-r3hg-m7w6.md)
  `GHSA-gcj7-r3hg-m7w6` · npm `openclaw`: affected `<2026.2.26`, fixed in `2026.2.26` · CVSS 3.7 Low · Not analysed yet · Published 3 Mar 2026 · Tags: Authentication bypass, CWE-345
- [OpenClaw improperly parses X-Forwarded-For behind trusted proxies allows client IP spoofing in security decisions](https://agentprime.io/advisories/GHSA-2rgf-hm63-5qph.md)
  `GHSA-2rgf-hm63-5qph`, `CVE-2026-32029` · npm `openclaw`: affected `<2026.2.21`, fixed in `2026.2.21` · CVSS 6.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-345, CWE-807
- [Dataease SQLBot JWT Token auth.py validateEmbedded signature verification](https://agentprime.io/advisories/CVE-2025-15598.md)
  `CVE-2025-15598` · CVE record: Dataease SQLBot · CVSS 6.3 Medium · Not analysed yet · Published 3 Mar 2026 · Tags: Weak cryptography or TLS, CWE-345
- [An authenticated arbitrary file upload vulnerability in Cohesity TranZman Migration Appliance Release 4.0 Build 14614 allows attackers with Administrator privileges to execute arbitrary code via uplo…](https://agentprime.io/advisories/CVE-2025-63910.md)
  `CVE-2025-63910` · CVE record · CVSS 7.2 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-345
- [Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification](https://agentprime.io/advisories/CVE-2026-2428.md)
  `CVE-2026-2428` · CVE record: techjewel Fluent Forms Pro Add On Pack · CVSS 7.5 High · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-345
- [Unitree Go2 Mobile Program Tampering Enables Root RCE](https://agentprime.io/advisories/CVE-2026-27510.md)
  `CVE-2026-27510` · CVE record: UnitreeRobotics Unitree Go2 · CVSS 6.4 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-345
- [Improper session management in D-Link Wireless N 300 ADSL2+ Modem Router DSL-124 ME_1.00 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.](https://agentprime.io/advisories/CVE-2025-71057.md)
  `CVE-2025-71057` · CVE record · CVSS 8.2 High · Not analysed yet · Published 26 Feb 2026 · Tags: Authentication bypass, CWE-345
- [Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter](https://agentprime.io/advisories/GHSA-4q3h-vp4r-prv2.md)
  `GHSA-4q3h-vp4r-prv2`, `BIT-parse-2026-27804`, `CVE-2026-27804` · npm `parse-server`: affected `<8.6.3 || >=9.0.0, <9.3.1-alpha.4`, fixed in `8.6.3`, `9.3.1-alpha.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Feb 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Hono is Vulnerable to Authentication Bypass by IP Spoofing in AWS Lambda ALB conninfo](https://agentprime.io/advisories/GHSA-xh87-mx6m-69f3.md)
  `GHSA-xh87-mx6m-69f3`, `CVE-2026-27700` · npm `hono`: affected `>=4.12.0, <4.12.2`, fixed in `4.12.2` · CVSS 8.2 High · Not analysed yet · Published 25 Feb 2026 · Tags: Authentication bypass, CWE-345
- [Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification](https://agentprime.io/advisories/CVE-2026-2968.md)
  `CVE-2026-2968` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Weak cryptography or TLS, CWE-345
- [The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay](https://agentprime.io/advisories/CVE-2026-2385.md)
  `CVE-2026-2385` · CVE record: posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 22 Feb 2026 · Tags: CWE-345
- [RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment](https://agentprime.io/advisories/CVE-2025-14444.md)
  `CVE-2025-14444` · CVE record: metagauss RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login · CVSS 5.3 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-345
- [OpenClaw inter-session prompts could be treated as direct user instructions](https://agentprime.io/advisories/GHSA-w5c7-9qqw-6645.md)
  `GHSA-w5c7-9qqw-6645` · npm `openclaw`: affected `<2026.2.13`, fixed in `2026.2.13` · CVSS 4.0, no score published · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-345
- [OpenClaw allows unauthenticated discovery TXT records to steer routing and TLS pinning](https://agentprime.io/advisories/GHSA-pv58-549p-qh99.md)
  `GHSA-pv58-549p-qh99`, `CVE-2026-26327` · npm `openclaw`: affected `<2026.2.14`, fixed in `2026.2.14` · CVSS 7.1 High · Not analysed yet · Published 18 Feb 2026 · Tags: CWE-345
- [OpenClaw has a potential access-group authorization bypass if channel type lookup fails](https://agentprime.io/advisories/GHSA-fhvm-j76f-qmjv.md)
  `GHSA-fhvm-j76f-qmjv`, `CVE-2026-28454` · npm `openclaw`: affected `<2026.2.1`, fixed in `2026.2.1` · CVSS 8.2 High · Not analysed yet · Published 17 Feb 2026 · Tags: Broken access control, CWE-345
- [OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations](https://agentprime.io/advisories/GHSA-3m3q-x3gj-f79x.md)
  `GHSA-3m3q-x3gj-f79x`, `CVE-2026-28465` · npm `@clawdbot/voice-call` and 1 more: affected `<=2026.1.24`, no fixed version yet · CVSS 8.2 High · Not analysed yet · Published 17 Feb 2026 · Tags: Authentication bypass, CWE-345
- [OpenClaw has a Telegram webhook request forgery (missing \`channels.telegram.webhookSecret\`) → auth bypass](https://agentprime.io/advisories/GHSA-mp5h-m6qj-6292.md)
  `GHSA-mp5h-m6qj-6292`, `CVE-2026-25474` · npm `openclaw`: affected `<2026.2.1`, fixed in `2026.2.1` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-345
- [cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves](https://agentprime.io/advisories/GHSA-r6ph-v2qm-q3c2.md)
  `GHSA-r6ph-v2qm-q3c2`, `CVE-2026-26007`, `PYSEC-2026-2141` · PyPI `cryptography`: affected `<46.0.5`, fixed in `46.0.5` · CVSS 8.2 High · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-345, CWE-354
- [Microsoft Exchange Server Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-21527.md)
  `CVE-2026-21527` · CVE record: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: CWE-345, CWE-451, CWE-1286
- [EVE Doesn't Protect Rootfs](https://agentprime.io/advisories/GHSA-5h7v-g49c-h887.md)
  `GHSA-5h7v-g49c-h887`, `CVE-2023-43636`, `GO-2026-4435` · Go `github.com/lf-edge/eve/pkg/grub`: affected `<0.0.0-20220708121648-5fef4d92e758`, fixed in `0.0.0-20220708121648-5fef4d92e758` · CVSS 8.8 High · Not analysed yet · Published 4 Feb 2026 · Tags: CWE-345
- [OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension](https://agentprime.io/advisories/CVE-2026-24775.md)
  `CVE-2026-24775` · CVE record: opf openproject · CVSS 6.3 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-345
- [OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server](https://agentprime.io/advisories/CVE-2026-24772.md)
  `CVE-2026-24772` · CVE record: opf openproject · CVSS 8.9 High · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-345
- [sm-crypto Affected by Private Key Recovery in SM2-PKE](https://agentprime.io/advisories/GHSA-pgx9-497m-6c4v.md)
  `GHSA-pgx9-497m-6c4v`, `CVE-2026-23966` · npm `sm-crypto`: affected `<0.3.14`, fixed in `0.3.14` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Jan 2026 · Tags: CWE-345
- [MineAdmin improperly refreshes tokens](https://agentprime.io/advisories/GHSA-43rr-x62x-q96w.md)
  `GHSA-43rr-x62x-q96w`, `CVE-2026-1195`, `PKSA-9946-kzvf-j5bc` · Packagist `mineadmin/mineadmin`: affected `>=1.0.0, <=2.0.3`, no fixed version yet · CVSS 2.3 Low · Not analysed yet · Published 20 Jan 2026 · Tags: CWE-345
- [Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation](https://agentprime.io/advisories/CVE-2026-0939.md)
  `CVE-2026-0939` · CVE record: linknacional Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit · CVSS 5.3 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-345
- [Cosign verification accepts any valid Rekor entry under certain conditions](https://agentprime.io/advisories/GHSA-whqx-f9j3-ch6m.md)
  `GHSA-whqx-f9j3-ch6m`, `BIT-cosign-2026-22703`, `CVE-2026-22703`, `GO-2026-4309` · Go `github.com/sigstore/cosign/v2` and 1 more: affected `<2.6.2`, fixed in `2.6.2` · CVSS 5.5 Medium · Not analysed yet · Published 13 Jan 2026 · Tags: CWE-345
- [Insufficient verification of data authenticity in TECNO Mobile com.afmobi.boomplayer](https://agentprime.io/advisories/CVE-2025-15385.md)
  `CVE-2025-15385` · CVE record: TECNO Mobile com.afmobi.boomplayer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jan 2026 · Tags: CWE-345
- [Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK](https://agentprime.io/advisories/GHSA-f3r2-88mq-9v4g.md)
  `GHSA-f3r2-88mq-9v4g`, `PKSA-3pss-my3n-f2df` · Packagist `auth0/symfony`: affected `>=5.0.0, <5.6.0`, fixed in `5.6.0` · CVSS 6.8 Medium · Not analysed yet · Published 17 Dec 2025 · Tags: Broken access control, CWE-345, CWE-1395
- [cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE\*/LOCAL\*)](https://agentprime.io/advisories/CVE-2025-66570.md)
  `CVE-2025-66570` · CVE record: yhirose cpp-httplib · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Dec 2025 · Tags: Authentication bypass, CWE-345, CWE-807
- [Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7 (patched in 13.6.12 (LTS) and 13.9.0 (STS)), allow a physically proximate attacker with root access to modify the Rec…](https://agentprime.io/advisories/CVE-2025-59700.md)
  `CVE-2025-59700` · CVE record · CVSS 5.8 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-345
- [OrangeHRM is Vulnerable to Account Takeover Through Unvalidated Username in Password Reset Workflow](https://agentprime.io/advisories/CVE-2025-66225.md)
  `CVE-2025-66225` · CVE record: orangehrm orangehrm · CVSS 8.7 High · Not analysed yet · Published 29 Nov 2025 · Tags: CWE-20, CWE-345
- [Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions](https://agentprime.io/advisories/GHSA-wmjr-v86c-m9jj.md)
  `GHSA-wmjr-v86c-m9jj`, `CVE-2025-71402` · npm `better-auth`: affected `>=1.3.34, <1.4.0`, fixed in `1.4.0` · CVSS 2.0 Low · Not analysed yet · Published 26 Nov 2025 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-345
- [Unauthenticated Arbitrary File Upload (upgrade_contents.php)](https://agentprime.io/advisories/CVE-2025-66255.md)
  `CVE-2025-66255` · CVE record: DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Nov 2025 · Tags: CWE-345
- [cggmp21 has a missing check in the ZK proof used in CGGMP21](https://agentprime.io/advisories/GHSA-m95p-425x-x889.md)
  `GHSA-m95p-425x-x889`, `CVE-2025-66016`, `RUSTSEC-2025-0129`, `RUSTSEC-2025-0130` · crates.io `cggmp21` and 1 more: affected `<0.6.3`, fixed in `0.6.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Nov 2025 · Tags: Weak cryptography or TLS, CWE-345
- [Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation](https://agentprime.io/advisories/CVE-2025-12752.md)
  `CVE-2025-12752` · CVE record: scottpaterson Subscriptions & Memberships for PayPal · CVSS 5.3 Medium · Not analysed yet · Published 22 Nov 2025 · Tags: CWE-345
- [eGovFramework <= 4.3.1 Unauthenticated Encryption Oracle via Web Editor Image Upload Endpoints](https://agentprime.io/advisories/CVE-2025-34337.md)
  `CVE-2025-34337` · CVE record: eGovFramework/egovframe-common-components eGovFramework/egovframe-common-components · CVSS 8.7 High · Not analysed yet · Published 19 Nov 2025 · Tags: CWE-345
- [AstrBot is vulnerable to RCE with hard-coded JWT signing keys](https://agentprime.io/advisories/GHSA-4m32-cjv7-f425.md)
  `GHSA-4m32-cjv7-f425`, `CVE-2025-55449`, `PYSEC-2026-285` · PyPI `astrbot`: affected `<3.5.18`, fixed in `3.5.18` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Nov 2025 · Tags: Hard-coded credentials, CWE-345
- [MantisBT lacks verification when changing a user's email address](https://agentprime.io/advisories/GHSA-q747-c74m-69pr.md)
  `GHSA-q747-c74m-69pr`, `CVE-2025-55155`, `PKSA-983m-gpx4-ywx3` · Packagist `mantisbt/mantisbt`: affected `<2.27.2`, fixed in `2.27.2` · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: Information disclosure, CWE-345, CWE-354
- [D-Link DAP-2695 Firmware Update sub_40C6B8 signature verification](https://agentprime.io/advisories/CVE-2025-12295.md)
  `CVE-2025-12295` · CVE record: D-Link DAP-2695 · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2025 · Tags: Weak cryptography or TLS, CWE-345
- [Intent Abuse in Google Messages for Wear OS for Silent Message Sending](https://agentprime.io/advisories/CVE-2025-12080.md)
  `CVE-2025-12080` · CVE record: Google WearOS · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-345
- [chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation](https://agentprime.io/advisories/CVE-2025-12245.md)
  `CVE-2025-12245` · CVE record: chatwoot · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2025 · Tags: CWE-345, CWE-346
- [An issue in the firmware update mechanism of Nous W3 Smart WiFi Camera v1.33.50.82 allows unauthenticated and physically proximate attackers to escalate privileges to root via supplying a crafted upd…](https://agentprime.io/advisories/CVE-2025-56438.md)
  `CVE-2025-56438` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: CWE-345
- [Rapid7 AppSpider Project Name Validation Bypass](https://agentprime.io/advisories/CVE-2025-11195.md)
  `CVE-2025-11195` · CVE record: Rapid7 AppSpider Pro · CVSS 3.3 Low · Not analysed yet · Published 30 Sept 2025 · Tags: CWE-20, CWE-345
- [Formbricks missing JWT signature verification](https://agentprime.io/advisories/CVE-2025-59934.md)
  `CVE-2025-59934` · CVE record: formbricks formbricks · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2025 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-345
- [Rancher CLI SAML authentication is vulnerable to phishing attacks](https://agentprime.io/advisories/GHSA-v3vj-5868-2ch2.md)
  `GHSA-v3vj-5868-2ch2`, `CVE-2024-58267`, `GO-2025-3984` · Go `github.com/rancher/rancher`: affected `>=2.9.0, <2.9.12 || >=2.10.0, <2.10.10 || >=2.11.0, <2.11.6 || >=2.12.0, <2.12.2`, fixed in `2.9.12`, `2.10.10`, `2.11.6`, `2.12.2` · CVSS 8.0 High · Not analysed yet · Published 26 Sept 2025 · Tags: CWE-345
- [Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)](https://agentprime.io/advisories/GHSA-9ggr-2464-2j32.md)
  `GHSA-9ggr-2464-2j32`, `CVE-2025-59420`, `PYSEC-2026-1200` · PyPI `authlib`: affected `<1.6.4`, fixed in `1.6.4` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2025 · Tags: Broken access control, CWE-345
- [matrix-js-sdk has insufficient validation when considering a room to be upgraded by another](https://agentprime.io/advisories/GHSA-mp7c-m3rh-r56v.md)
  `GHSA-mp7c-m3rh-r56v`, `CVE-2025-59160` · npm `matrix-js-sdk`: affected `<38.2.0`, fixed in `38.2.0` · CVSS 2.7 Low · Not analysed yet · Published 16 Sept 2025 · Tags: Broken access control, CWE-20, CWE-345

Newest: <https://agentprime.io/advisories/tag/cwe-345.md>
Older: <https://agentprime.io/advisories/tag/cwe-345.md?cursor=WyIyMDI1LTA5LTE2VDIwOjE4OjU3LjAwMDAwMFoiLCJHSFNBLW1wN2MtbTNyaC1yNTZ2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-345&cursor=WyIyMDI2LTAzLTE2VDEyOjM1OjA2LjIyMjAwMFoiLCJDVkUtMjAyNS01MjYzOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-345/?cursor=WyIyMDI2LTAzLTE2VDEyOjM1OjA2LjIyMjAwMFoiLCJDVkUtMjAyNS01MjYzOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.